Ethical Hacking News
MarkLogic Flaw: Persistent Admin Control at Risk as Two Critical Vulnerabilities Exposed
Critical vulnerabilities in MarkLogic Server, a database management system, have been exposed, putting user data and control at risk. Two critical flaws, CVE-2026-85947 and CVE-2026-85948, have the potential to allow delegated managers to gain persistent admin control of the server. Progress Software has released fixes for the vulnerabilities in MarkLogic 11.3.7 and 12.1.0, and has advised customers to upgrade to the latest versions as soon as possible. Organizations must stay up-to-date with the latest security patches and review their security settings and configurations to prevent unauthorized access to sensitive data.
Progress Software has published 31 newly disclosed flaws in its MarkLogic Server database management system, with 5 scored as critical. Two critical flaws, CVE-2026-85947 and CVE-2026-85948, allow delegated managers to gain persistent admin control of the server. The flaws are due to a combination of configuration issues and design vulnerabilities in the system. The company has released fixes for the vulnerabilities in MarkLogic 11.3.7 and 12.1.0, but some problems may remain after the upgrade. Customers are advised to review their delegated forest and database privilege assignments and audit the roles that hold the xdmp-eval-in privilege. The exposure of these vulnerabilities highlights the importance of regular security updates and patching.
Critical vulnerabilities in MarkLogic Server, a database management system, have been exposed, putting user data and control at risk. The two critical flaws, CVE-2026-85947 and CVE-2026-85948, have the potential to allow delegated managers to gain persistent admin control of the server. This means that even if an individual has limited administrative privileges, they could potentially access and manipulate sensitive data and execute malicious actions on the server.
According to the latest news from The Hacker News, Progress Software, the company behind MarkLogic Server, has published 31 newly disclosed flaws in its database management system. The company has scored five of these flaws as critical, with the two mentioned above being among them. These flaws are a result of a combination of configuration issues and design vulnerabilities in the system.
The first critical flaw, CVE-2026-85947, allows an account with forest-management privileges to create a persistent administrator account. This means that even if the user does not have full admin access, they could potentially create a new admin account that grants them full control over the server. The second critical flaw, CVE-2026-85948, involves an XQuery injection flaw in a deprecated Management API path. This allows an attacker to gain persistent administrative control of the server by manipulating the API.
The vulnerabilities have been assigned a critical severity rating by Progress Software, indicating that they have the potential to allow unauthorized access to sensitive data and execute malicious actions on the server. The company has released fixes for the vulnerabilities in MarkLogic 11.3.7 and 12.1.0, and has advised customers to upgrade to the latest versions as soon as possible.
However, the fixes for the 10 MarkLogic flaws that were published in August are not enough to address the new vulnerabilities. The latest flaws are part of a second batch of vulnerabilities that Progress Software has disclosed in 68 days, with the first batch published in August. The company has scored 24 of the remaining flaws high and two medium, indicating that they have the potential to allow unauthorized access to sensitive data and execute malicious actions on the server.
The vulnerabilities have been reported by outside researchers, including rexnets and WaltWhitehat, who have credited themselves with discovering several of the flaws. The vulnerabilities have also been identified by The Hacker News, which has checked the Progress Software CVE records and upgrade notes for the two releases.
Progress Software has recommended that customers review their delegated forest and database privilege assignments before upgrading to the latest versions, and to audit the roles that hold the xdmp-eval-in privilege. The company has also warned customers that some problems may remain after the upgrade, including the possibility that successful logins may not always be recorded in the audit log.
The exposure of these vulnerabilities highlights the importance of regular security updates and patching. MarkLogic Server is a popular database management system used by many organizations, and the exposure of these vulnerabilities puts user data and control at risk. It is essential for organizations to stay up-to-date with the latest security patches and to review their security settings and configurations to prevent unauthorized access to sensitive data.
Related Information:
https://www.ethicalhackingnews.com/articles/MarkLogic-Flaw-Persistent-Admin-Control-at-Risk-as-Two-Critical-Vulnerabilities-Exposed-ehn.shtml
https://thehackernews.com/2026/10/two-critical-marklogic-flaws-could-give.html
https://nvd.nist.gov/vuln/detail/CVE-2026-85947
https://www.cvedetails.com/cve/CVE-2026-85947/
https://nvd.nist.gov/vuln/detail/CVE-2026-85948
https://www.cvedetails.com/cve/CVE-2026-85948/
Published: Tue Oct 13 05:08:01 2026 by llama3.2 3B Q4_K_M
